help with a hjt log please

i created the report in avg before i applied the actions, so it is in quarentine already i am having trouble finding the txt file you asked for in 'called output', can't find that folder.

It should be right on your C:\ drive. –> C:\output.txt

I just ran it to doulbecheck that I posted it correctly and output.txt showed up on my C: folder.

Try it again
regedit /e c:\output.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Just go to Start > Run and paste the entire line in and click on OK… Then go to My Computer> C: and it should be there.

Ken

is this what ur looking for Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "AutoRestartShell"=dword:00000001 "DefaultDomainName"="YOUR-D65BBC6695" "DefaultUserName"="HP_Owner" "LegalNoticeCaption"="" "LegalNoticeText"="" "PowerdownAfterShutdown"="0" "ReportBootOk"="1" "Shell"="Explorer.exe" "ShutdownWithoutLogon"="0" "Userinit"="\\windows\\system32\\userinit.exe," "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\"" "SfcQuota"=dword:ffffffff "allocatecdroms"="0" "allocatedasd"="0" "allocatefloppies"="0" "cachedlogonscount"="10" "forceunlocklogon"=dword:00000000 "passwordexpirywarning"=dword:0000000e "scremoveoption"="0" "AllowMultipleTSSessions"=dword:00000001 "UIHost"=hex(2):6c,00,6f,00,67,00,6f,00,6e,00,75,00,69,00,2e,00,65,00,78,00,65,\ 00,00,00 "LogonType"=dword:00000001 "Background"="0 0 0" "DebugServerCommand"="no" "SFCDisable"=dword:00000000 "WinStationsDisabled"="0" "HibernationPreviouslyEnabled"=dword:00000001 "ShowLogonOptions"=dword:00000000 "AltDefaultUserName"="HP_Owner" "AltDefaultDomainName"="YOUR-D65BBC6695" "system"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @="Microsoft Disk Quota" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=hex(2):64,00,73,00,6b,00,71,00,75,00,6f,00,74,00,61,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "ProcessGroupPolicy"="ProcessGroupPolicy" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] @="Internet Explorer Zonemapping" "DllName"=hex(2):69,00,65,00,64,00,6b,00,63,00,73,00,33,00,32,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap" "NoGPOListChanges"=dword:00000001 "RequiresSucessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] "ProcessGroupPolicy"="SceProcessSecurityPolicyGPO" "GenerateGroupPolicy"="SceGenerateGroupPolicy" "ExtensionRsopPlanningDebugLevel"=dword:00000001 "ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx" "ExtensionDebugLevel"=dword:00000001 "DllName"=hex(2):73,00,63,00,65,00,63,00,6c,00,69,00,2e,00,64,00,6c,00,6c,00,\ 00,00 @="Security" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000001 "MaxNoGPOListChangesInterval"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "ProcessGroupPolicy"="ProcessGroupPolicy" "DllName"=hex(2):69,00,65,00,64,00,6b,00,63,00,73,00,33,00,32,00,2e,00,64,00,\ 6c,00,6c,00,00,00 @="Internet Explorer Branding" "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] "ProcessGroupPolicy"="SceProcessEFSRecoveryGPO" "DllName"=hex(2):73,00,63,00,65,00,63,00,6c,00,69,00,2e,00,64,00,6c,00,6c,00,\ 00,00 @="EFS recovery" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] @="Microsoft Offline Files" "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,\ 00,73,00,63,00,75,00,69,00,2e,00,64,00,6c,00,6c,00,00,00 "EnableAsynchronousProcessing"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000000 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] @="Software Installation" "DllName"=hex(2):61,00,70,00,70,00,6d,00,67,00,6d,00,74,00,73,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "RequiresSucessfulRegistry"=dword:00000000 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "EventSources"=hex(7):28,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,\ 00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,00,6e,00,\ 74,00,2c,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,\ 00,29,00,00,00,28,00,4d,00,73,00,69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,\ 6c,00,65,00,72,00,2c,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,\ 00,6f,00,6e,00,29,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] "Logon"="WLEventLogon" "Logoff"="WLEventLogoff" "Startup"="WLEventStartup" "Shutdown"="WLEventShutdown" "StartScreenSaver"="WLEventStartScreenSaver" "StopScreenSaver"="WLEventStopScreenSaver" "Lock"="WLEventLock" "Unlock"="WLEventUnlock" "StartShell"="WLEventStartShell" "PostShell"="WLEventPostShell" "Disconnect"="WLEventDisconnect" "Reconnect"="WLEventReconnect" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000000 "SafeMode"=dword:00000001 "MaxWait"=dword:ffffffff "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Event"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings] "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\ 00,00,68,42,7d,b8,3e,97,b8,49,8a,d6,c7,3c,6a,c0,00,d4,04,00,00,00,04,00,00,\ 00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,eb,d6,81,3d,7c,4a,cb,92,\ 2b,a3,3c,00,33,2c,9b,94,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,1b,\ 31,49,33,d9,a8,6e,8d,4a,3d,91,29,6c,23,56,a2,08,06,00,00,e0,66,f5,e3,26,5c,\ e7,06,ce,f2,a1,b2,cd,1f,27,0a,f5,fb,7d,26,b8,bf,e7,07,f7,7f,65,56,54,c7,2f,\ 23,d7,24,4c,3f,dd,6b,32,49,a4,57,6d,1f,a5,f1,04,51,73,e5,0d,84,f3,16,68,96,\ 85,ae,ed,38,23,f1,6d,05,d3,ff,4a,b6,a0,5b,01,9a,08,74,41,c8,fb,26,d3,de,05,\ be,24,35,eb,a0,9b,e7,1c,b4,b7,01,ef,01,cb,fb,28,e5,ec,5f,b4,7a,41,5e,1b,6b,\ 0a,88,c4,62,83,24,c7,bb,99,af,85,35,0c,05,91,06,a5,22,6f,52,ba,5e,c9,af,45,\ c2,a4,89,75,87,39,a6,64,fb,2c,ed,1d,9c,27,67,10,c1,ef,2e,42,53,8e,ad,98,82,\ b5,01,89,f6,84,22,f5,df,2d,54,99,21,dc,b5,82,e4,37,d9,47,85,88,c5,67,fd,f0,\ 4d,77,99,aa,e5,09,66,f7,de,08,d9,ec,45,ee,16,62,e2,26,95,dd,cb,6f,cf,53,f2,\ e5,53,a9,c0,0e,b1,18,1c,fe,d5,5d,ca,1f,36,ab,d4,83,0c,d2,0d,0e,f5,9e,61,48,\ f6,73,e1,c7,2b,0e,07,dd,df,a2,13,8b,69,d6,e3,8f,af,e7,97,d1,50,9a,7b,31,fa,\ c7,8b,83,87,dd,22,39,2b,53,4d,e7,18,fa,6c,ac,84,73,ef,20,71,25,af,3d,43,be,\ 6a,f9,3f,1f,75,64,da,84,96,c6,04,ed,a2,29,0a,b8,2e,cd,4b,b3,9e,ba,ca,a1,95,\ 15,fd,c9,cc,7d,43,c3,51,7b,d6,9f,fd,4e,e9,db,4c,74,15,6a,a4,27,5c,91,35,64,\ 70,e2,9c,20,b4,35,13,0f,dc,36,82,9a,46,8f,e6,42,cb,86,bf,92,94,9c,70,b8,a2,\ b5,b5,e2,21,96,b2,d4,22,e5,b9,57,d7,44,00,4e,8b,73,a3,f2,b7,2d,2b,c5,45,eb,\ dc,6c,bc,31,fe,9c,e0,40,d9,a9,36,33,5a,36,58,2b,a2,ae,9d,7d,94,b0,2e,1e,67,\ aa,ad,03,f2,56,f4,e6,f9,ef,2c,50,34,b4,8e,10,80,5b,86,16,4e,82,a3,fd,79,32,\ 5c,0d,5b,67,47,71,75,e2,1d,4f,37,f1,98,88,de,ec,51,b6,24,4f,1b,a7,52,d8,93,\ 92,e5,0c,cf,7a,20,84,16,19,9a,6d,2e,c5,56,6f,1f,04,da,4f,c9,c7,0f,c8,39,06,\ 65,e1,a1,a8,05,a3,99,0a,b2,ab,21,fb,07,d7,0c,ce,0b,a8,32,9e,b3,f8,c5,c1,31,\ d2,d6,52,7e,0c,9b,77,c6,0f,32,7f,32,b3,88,c7,77,9a,12,cc,b6,9d,26,b6,1e,4c,\ 0b,89,fd,4c,4f,75,39,53,9a,53,20,fa,6f,9b,49,27,e3,af,f2,2b,fa,d7,33,9f,0e,\ fb,fe,7d,c8,e2,73,e8,da,33,78,da,ba,8b,b6,3c,1d,98,ee,3e,0d,07,21,bd,24,de,\ c4,ae,00,c8,49,dd,d1,8c,9a,89,f9,cd,e7,48,b0,36,8a,a4,22,d2,a8,d2,7c,f4,83,\ 60,12,04,07,ac,b4,2b,39,97,aa,af,25,21,1a,8c,20,12,50,ae,57,15,20,28,8a,01,\ 35,b5,b8,b8,43,bf,8f,13,96,cd,52,41,3b,a7,55,2f,19,23,01,d1,04,db,91,e2,3e,\ 8c,80,45,75,16,3b,82,00,6d,4f,83,a6,2e,97,b7,76,b2,b1,3b,49,61,51,f0,81,5b,\ 8b,3e,41,5f,42,5e,af,93,b9,46,d2,5a,0f,8e,49,44,bd,26,84,ff,5a,73,e9,50,ac,\ 22,94,fe,c3,85,27,78,19,2b,78,b0,6c,3c,2b,38,b0,25,5c,e8,92,37,28,2d,1f,a6,\ d6,55,77,d1,89,94,9d,7c,ba,46,82,05,61,2a,26,85,f2,90,ab,cb,02,cc,67,b6,64,\ f6,ff,53,29,2b,09,d4,13,83,b4,de,43,1c,ee,cb,aa,96,2a,1c,88,e9,62,32,1a,e8,\ 33,03,56,9c,00,65,5b,eb,fd,2b,15,4e,3c,e5,ec,7d,b9,46,a5,d4,f0,0a,33,3a,26,\ b5,da,b4,37,76,52,cb,e6,19,9e,3a,f2,9a,0b,b6,74,9a,00,7b,fa,a5,2f,a7,18,6d,\ a9,03,01,94,c1,74,b3,d6,1d,2d,3c,03,85,f4,f6,f7,0e,bc,35,8c,6d,93,0d,11,1b,\ 1c,15,dc,da,a3,25,c3,97,01,0c,3e,5b,ba,eb,27,7b,fc,8c,29,ca,1c,ca,81,60,62,\ e0,3f,1f,ea,ef,1b,8f,4e,a0,34,e0,ef,ae,69,14,2d,c4,f9,de,cd,c0,60,c2,bd,fa,\ 25,55,6e,e7,2c,50,de,e7,91,66,c2,45,cf,ac,07,8c,e5,6a,02,fe,e8,73,12,5e,10,\ c2,82,6b,de,d9,74,7c,c7,f8,28,76,2a,1f,7e,3c,e8,3e,60,65,89,e8,00,6a,58,93,\ 13,92,04,c7,1b,7a,a9,dd,4e,6e,b0,46,bd,48,93,2b,87,77,81,09,40,3d,f2,e3,4a,\ bc,f0,51,07,99,38,8f,ad,c4,02,55,04,17,77,7d,1f,94,b8,64,6e,4c,5d,af,76,35,\ 3d,53,d8,9f,4a,43,7e,e4,db,6f,3b,a7,f2,2c,91,18,c9,69,e0,e0,03,5d,e7,86,a9,\ 21,2c,4f,02,d2,0b,5b,94,8b,5d,7e,6c,93,8f,de,42,2f,69,a1,95,54,f5,ce,ab,58,\ 81,32,86,6d,87,43,dc,2c,98,17,80,7d,8e,4c,7b,2e,be,8f,21,22,b8,30,f4,a0,95,\ 53,94,74,16,19,5b,6f,82,12,54,2a,17,ab,a9,28,21,5c,be,af,b7,37,75,5d,6c,b0,\ 93,dd,53,a3,67,73,a3,87,db,4e,68,d0,0d,fb,e2,93,33,26,c2,c0,ed,68,70,c0,81,\ 9d,df,80,75,80,d5,7b,e8,84,d6,e0,95,2d,6e,12,c9,e2,dd,73,59,20,60,9d,e3,d4,\ ba,67,1c,7a,c2,84,1c,73,80,63,9b,23,38,7a,f1,ca,0d,9c,80,a8,eb,73,82,cf,63,\ 8d,cf,41,fd,e0,21,df,6c,78,83,18,25,57,dc,27,1e,e2,67,c4,34,d3,7a,9f,e7,41,\ a4,d9,08,6d,83,96,91,cb,f9,6d,19,f9,d0,e3,30,2d,b2,14,36,dd,5c,ca,4c,a3,9e,\ 5c,bb,45,67,e8,72,78,a2,10,fe,6c,70,db,3f,00,1e,98,b1,d5,82,7c,56,05,78,46,\ 9b,2b,4a,59,8b,e2,fc,97,92,20,86,20,e5,df,a0,17,ab,f2,4d,66,ef,30,5c,26,fc,\ 62,14,c5,7c,be,7e,34,7a,1f,a3,13,38,ac,67,42,73,dc,7b,b5,b0,89,fe,b5,a2,81,\ 48,d6,f3,fe,88,17,fb,f4,93,77,28,45,0f,3f,c4,fd,28,74,b5,3e,1b,32,4f,13,b7,\ 4b,b6,3a,55,5d,b7,e9,48,48,e7,fa,f0,a8,81,1b,a7,71,53,47,d7,2e,3e,30,ad,27,\ a4,ac,31,8d,24,6e,1e,c2,d7,e7,dc,1a,31,54,33,5f,5f,af,1f,1c,d4,6a,fc,37,33,\ 87,b9,0f,d5,e8,c7,02,2a,08,2e,25,db,fa,f4,97,a0,3c,1d,f0,9f,83,f6,20,4a,4b,\ d2,8f,6c,58,9b,98,a2,31,eb,b0,2c,95,ca,50,c3,76,f8,66,86,89,bb,3b,15,ed,0d,\ fa,9b,bd,86,86,fb,c0,06,68,87,e0,d6,43,a3,8b,46,80,ec,0d,b0,28,62,1b,1f,da,\ 69,20,a0,5d,7d,a8,81,35,9e,db,69,12,16,a5,9e,92,d8,4e,2a,40,bd,b7,7e,68,45,\ fc,ca,d3,e7,51,0c,3d,ff,90,15,15,cf,3e,8d,08,6b,39,78,95,80,77,38,2a,a4,eb,\ ae,51,14,23,37,62,7a,dc,4e,b5,12,22,27,a9,fe,95,be,c3,2a,c4,68,f2,6f,06,43,\ 5a,c7,26,7f,19,be,21,4a,d1,80,15,1a,2b,14,00,00,00,e3,b5,8e,24,c8,95,cf,f2,\ a6,a3,cd,44,28,ee,25,93,ba,63,a3,1c [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SCLogon] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList] "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000

lbw666,

This is what I have been looking for, "Userinit"="\\windows\\system32\\userinit.exe," but I have had other people on the forum look at it and we don't know why its listed like this. Usually if there is a coma following userinit.exe it means its linked to malware or a virus but none is showing up on your scans. So lets just leave this be for the time being, I am waiting for other input on it. The rest of your log looks fine


You can read and install these free programs , I will get back to you as soon as I find out more on this issue.

Please don't take it on your own to fix it because if its legit and remove it you may not be able to log back into windows. <– This is why I have been overcaucious about finding out about it.


How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go

Ken

ok cheers

lbw666,

Lets do this to fix this entry.

Copy everything inside the quote box and save it to Notepad. Then save the file to your desktop and name it Winlog.reg , be sure to select the flle type as All Files

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

Right click this file on your desktop and click on Merge, when it asks you if you want to merge this with the registry…say Yes.


Go to your C:\ drive and delete Output.txt

Then go to Start> Run and copy and paste this script into the run box and click on OK, it will produce a new Output file on your C:\ drive, copy and paste it into this thread

regedit /e c:\output.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Please do not reboot until I look at the report.

here's the output Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "AutoRestartShell"=dword:00000001 "DefaultDomainName"="YOUR-D65BBC6695" "DefaultUserName"="HP_Owner" "LegalNoticeCaption"="" "LegalNoticeText"="" "PowerdownAfterShutdown"="0" "ReportBootOk"="1" "Shell"="Explorer.exe" "ShutdownWithoutLogon"="0" "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\"" "SfcQuota"=dword:ffffffff "allocatecdroms"="0" "allocatedasd"="0" "allocatefloppies"="0" "cachedlogonscount"="10" "forceunlocklogon"=dword:00000000 "passwordexpirywarning"=dword:0000000e "scremoveoption"="0" "AllowMultipleTSSessions"=dword:00000001 "UIHost"=hex(2):6c,00,6f,00,67,00,6f,00,6e,00,75,00,69,00,2e,00,65,00,78,00,65,\ 00,00,00 "LogonType"=dword:00000001 "Background"="0 0 0" "DebugServerCommand"="no" "SFCDisable"=dword:00000000 "WinStationsDisabled"="0" "HibernationPreviouslyEnabled"=dword:00000001 "ShowLogonOptions"=dword:00000000 "AltDefaultUserName"="HP_Owner" "AltDefaultDomainName"="YOUR-D65BBC6695" "system"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] @="Microsoft Disk Quota" "NoMachinePolicy"=dword:00000000 "NoUserPolicy"=dword:00000001 "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "RequiresSuccessfulRegistry"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000000 "DllName"=hex(2):64,00,73,00,6b,00,71,00,75,00,6f,00,74,00,61,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "ProcessGroupPolicy"="ProcessGroupPolicy" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] @="Internet Explorer Zonemapping" "DllName"=hex(2):69,00,65,00,64,00,6b,00,63,00,73,00,33,00,32,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap" "NoGPOListChanges"=dword:00000001 "RequiresSucessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] "ProcessGroupPolicy"="SceProcessSecurityPolicyGPO" "GenerateGroupPolicy"="SceGenerateGroupPolicy" "ExtensionRsopPlanningDebugLevel"=dword:00000001 "ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx" "ExtensionDebugLevel"=dword:00000001 "DllName"=hex(2):73,00,63,00,65,00,63,00,6c,00,69,00,2e,00,64,00,6c,00,6c,00,\ 00,00 @="Security" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "EnableAsynchronousProcessing"=dword:00000001 "MaxNoGPOListChangesInterval"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] "ProcessGroupPolicyEx"="ProcessGroupPolicyEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "ProcessGroupPolicy"="ProcessGroupPolicy" "DllName"=hex(2):69,00,65,00,64,00,6b,00,63,00,73,00,33,00,32,00,2e,00,64,00,\ 6c,00,6c,00,00,00 @="Internet Explorer Branding" "NoSlowLink"=dword:00000001 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000001 "NoMachinePolicy"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] "ProcessGroupPolicy"="SceProcessEFSRecoveryGPO" "DllName"=hex(2):73,00,63,00,65,00,63,00,6c,00,69,00,2e,00,64,00,6c,00,6c,00,\ 00,00 @="EFS recovery" "NoUserPolicy"=dword:00000001 "NoGPOListChanges"=dword:00000001 "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] @="Microsoft Offline Files" "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,\ 00,73,00,63,00,75,00,69,00,2e,00,64,00,6c,00,6c,00,00,00 "EnableAsynchronousProcessing"=dword:00000000 "NoBackgroundPolicy"=dword:00000000 "NoGPOListChanges"=dword:00000000 "NoMachinePolicy"=dword:00000000 "NoSlowLink"=dword:00000000 "NoUserPolicy"=dword:00000001 "PerUserLocalSettings"=dword:00000000 "ProcessGroupPolicy"="ProcessGroupPolicy" "RequiresSuccessfulRegistry"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] @="Software Installation" "DllName"=hex(2):61,00,70,00,70,00,6d,00,67,00,6d,00,74,00,73,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx" "GenerateGroupPolicy"="GenerateGroupPolicy" "NoBackgroundPolicy"=dword:00000000 "RequiresSucessfulRegistry"=dword:00000000 "NoSlowLink"=dword:00000001 "PerUserLocalSettings"=dword:00000001 "EventSources"=hex(7):28,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,\ 00,6f,00,6e,00,20,00,4d,00,61,00,6e,00,61,00,67,00,65,00,6d,00,65,00,6e,00,\ 74,00,2c,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,\ 00,29,00,00,00,28,00,4d,00,73,00,69,00,49,00,6e,00,73,00,74,00,61,00,6c,00,\ 6c,00,65,00,72,00,2c,00,41,00,70,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,\ 00,6f,00,6e,00,29,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] "Logon"="WLEventLogon" "Logoff"="WLEventLogoff" "Startup"="WLEventStartup" "Shutdown"="WLEventShutdown" "StartScreenSaver"="WLEventStartScreenSaver" "StopScreenSaver"="WLEventStopScreenSaver" "Lock"="WLEventLock" "Unlock"="WLEventUnlock" "StartShell"="WLEventStartShell" "PostShell"="WLEventPostShell" "Disconnect"="WLEventDisconnect" "Reconnect"="WLEventReconnect" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000000 "SafeMode"=dword:00000001 "MaxWait"=dword:ffffffff "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Event"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings] "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\ 00,00,68,42,7d,b8,3e,97,b8,49,8a,d6,c7,3c,6a,c0,00,d4,04,00,00,00,04,00,00,\ 00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,b6,a9,2a,8c,f6,7f,c0,3a,\ f2,4c,f6,29,3d,c0,d0,23,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,c7,\ 3f,60,6b,9a,99,fc,19,90,8b,f4,3f,08,1f,01,0f,08,06,00,00,ab,9f,bb,c4,f4,7e,\ fc,87,f7,5d,8b,26,e8,81,9f,7d,f3,4a,90,35,f0,b7,ca,22,76,b4,06,b5,2a,ce,6e,\ ed,52,d7,f5,2c,cc,e8,b0,f4,7b,1e,9a,69,cf,b8,69,8c,43,a7,ed,ab,4d,94,bd,92,\ c8,e2,da,4f,f2,e7,a1,0a,62,03,38,67,9d,e5,9a,1d,69,e8,82,cc,9f,8d,51,e0,9f,\ 4a,0c,9d,c2,d6,c4,1d,89,9f,93,26,77,48,cf,d5,9a,50,04,cd,e5,58,49,40,c8,82,\ 3a,44,99,7d,83,b9,73,30,62,1b,40,90,fe,27,14,8a,36,f8,ee,d7,1e,c9,53,40,3d,\ 72,e7,e8,9d,fb,d9,fb,0e,7b,39,21,ca,fa,2d,c7,0c,21,15,b3,bf,8a,38,5c,59,ab,\ a6,a6,d5,07,cb,d1,4f,9c,24,67,e7,dc,8b,c6,41,09,2b,45,8d,57,e2,70,2e,ed,80,\ 65,4a,75,b4,46,ea,cd,d4,4d,58,04,13,f5,bd,26,cd,a3,ac,15,32,bd,94,df,28,66,\ 70,57,00,fe,04,0d,a8,4f,7e,71,53,50,3a,5e,01,d4,85,09,21,bf,40,09,32,ac,79,\ f5,eb,03,fd,00,5c,5d,be,7c,38,b0,63,8f,f3,dc,1c,49,20,15,2f,67,de,95,fd,97,\ 9a,b1,4f,28,24,53,6f,c9,a1,44,45,0a,22,02,07,a9,9d,13,4f,8d,cf,e7,f0,12,8b,\ ac,8e,83,ce,1b,10,e3,46,88,f8,77,cc,7f,a8,1d,e9,67,ce,df,4d,f5,01,5d,a3,b6,\ 4e,d8,ba,9d,d4,bf,1b,c2,e1,85,f4,9b,87,ab,87,0d,45,c1,df,ee,cf,52,b4,c9,6a,\ b7,11,ff,af,48,08,f0,fd,47,d9,6d,e6,03,13,c0,da,0c,2b,3c,9d,58,b4,27,a4,3c,\ 92,41,0c,25,1f,9d,4f,6f,4d,82,01,56,65,08,7e,35,ea,c3,f4,1b,c2,65,64,dc,3a,\ 7e,4f,ec,64,07,c8,51,06,5c,8b,6c,f2,13,94,c6,fd,f9,2f,bf,a0,a4,4b,a3,c3,e2,\ 38,98,8b,30,f9,e9,5c,2d,11,02,eb,51,f0,f2,d1,52,3b,d8,b3,07,92,0f,c8,3d,77,\ 76,b2,4a,4e,58,c6,67,39,03,b4,70,8a,15,97,95,e7,9a,66,69,01,40,92,a0,7f,b3,\ 0c,6e,c8,9b,22,64,f0,1e,f0,6e,27,bf,2a,9a,83,a0,8a,15,3c,6f,9a,b4,8f,e6,57,\ 20,7f,6f,b4,25,f8,4e,e0,f4,f8,bc,8d,c0,3c,fc,2c,e3,3f,42,48,d5,e0,7b,e8,e5,\ d5,bc,f1,30,ac,5d,26,c5,b5,43,cd,40,b6,e3,5e,10,60,d2,6c,5c,d8,c9,63,7a,b1,\ 30,86,1e,c2,38,39,ad,2c,cc,40,f6,ba,8e,a1,81,3f,eb,c2,b9,e5,b6,fc,8a,7a,a7,\ 60,13,d6,b4,5a,29,0c,f8,23,3f,73,02,69,ce,8a,03,9c,01,79,42,d6,c7,ca,84,f1,\ a1,61,6d,3c,b1,ba,cb,96,c7,7b,11,52,6d,66,af,fa,1c,ed,c1,d3,77,30,f8,3d,f3,\ c8,7a,8e,f6,1f,b0,f1,71,3c,70,bf,c2,a6,a9,71,a9,80,86,69,d5,d3,6c,88,e2,6a,\ ff,28,0b,72,b3,3e,d1,f2,88,6a,20,28,0c,06,a3,c3,10,8e,cb,2c,5a,b7,d3,ce,5e,\ e6,4c,50,98,dd,38,32,c4,52,30,43,fa,54,0e,9d,8b,80,78,69,fa,72,b4,9a,6d,50,\ 57,a5,d9,30,cd,06,8b,3e,8c,92,63,f5,cf,2e,e3,ea,68,3c,6b,c4,54,17,f2,31,db,\ d3,41,93,b5,52,48,ce,0c,62,f4,45,4d,a8,b2,9d,49,fe,b3,d1,6f,53,d8,11,dd,2e,\ 26,4f,41,13,6c,5c,ba,08,d4,8a,74,29,92,c5,11,31,ce,46,e1,77,08,27,a6,db,3f,\ 03,4c,cc,11,38,c2,5f,e2,43,ec,07,2a,9c,62,9f,86,a4,e1,b7,93,4e,c7,15,2c,ec,\ 06,eb,94,f6,b3,4d,0c,1c,c1,28,21,0d,a3,82,c4,9d,e0,3a,91,08,29,48,f5,92,fc,\ 62,d7,99,b7,24,99,b2,90,8d,6f,19,b2,9e,0f,0b,d5,5b,6f,5c,a1,e0,fe,70,b5,26,\ e4,a3,1e,14,02,09,07,a3,10,20,07,8d,22,60,8b,d1,84,11,c1,90,f6,be,43,ab,2e,\ 41,7a,c3,0c,73,1a,37,aa,a2,f3,a8,c8,12,04,32,3f,de,b6,e1,08,81,b8,3b,4a,78,\ 85,33,d6,45,e2,3b,e3,2e,a5,6b,ae,4c,5b,fa,84,40,8d,67,e7,23,84,32,f4,0b,42,\ c4,29,2b,62,31,3c,61,69,ce,08,29,2a,95,de,03,7d,fd,ef,50,c2,a5,48,b2,c2,8b,\ fb,33,ed,d3,cb,5b,89,4c,47,db,95,a2,c9,83,d1,a4,da,98,16,cd,48,e9,60,dd,42,\ fe,7b,3d,e8,bb,bd,66,a5,c9,8e,1f,31,49,b1,90,1e,55,01,84,2b,6f,c5,bd,20,06,\ 7c,b5,e1,36,98,f3,e5,50,e9,7c,8f,e8,83,9a,1d,60,71,01,f3,75,c2,61,8e,eb,c9,\ 43,e2,d0,36,33,69,2b,49,60,d8,b3,f2,ba,82,92,71,82,8e,ad,e9,1d,4b,92,64,56,\ 52,66,3c,41,a7,b3,98,99,15,d6,1c,83,ab,e4,c1,4e,f2,e9,11,6a,aa,81,c3,4a,c8,\ 0a,73,ab,cf,14,35,b1,00,21,f6,38,e3,9b,c4,be,9e,0c,3c,b8,f0,10,c5,fa,e4,ed,\ 6c,0a,cc,98,16,d9,31,fc,b0,4c,92,c1,5a,a7,2d,ed,ac,92,07,84,05,37,88,e9,07,\ cf,c5,d1,dd,76,c9,55,67,1a,9a,e9,88,9a,13,38,55,dd,0a,5d,f5,33,b3,a7,39,41,\ 65,b7,be,3e,06,d3,dc,90,42,7f,8a,be,a7,3f,b3,42,97,c5,16,fd,68,4c,45,d2,4b,\ e2,6b,39,e9,76,16,14,85,28,25,70,bb,58,64,22,38,e2,a1,58,bb,40,c1,15,d9,0b,\ e6,f0,98,1a,fd,b9,2e,34,f2,0e,09,f9,61,7c,14,f3,9e,ba,78,2c,0b,a8,ad,0c,6d,\ c3,3b,57,1d,f4,69,95,52,5e,df,70,7f,8d,17,aa,17,6a,37,70,ec,30,fc,09,0e,5e,\ 1f,15,f0,af,db,fd,f6,3a,f1,93,d0,02,14,60,04,dc,ee,fb,f9,5e,7a,dd,9c,42,8b,\ d1,e0,f6,d8,45,84,dc,30,50,ed,c4,1a,93,a2,08,1f,59,6d,ee,fa,28,50,a3,39,32,\ 24,be,72,cf,fd,a3,d9,bf,7a,c1,48,27,9c,a6,84,f5,e9,c1,0e,61,52,23,9f,f2,c9,\ e7,c1,29,9a,e3,d7,40,de,8c,48,2c,8b,bf,cf,e0,aa,d4,d1,0e,50,1b,15,f9,ca,bf,\ 43,ae,42,17,3f,cf,28,3a,e3,91,44,e2,91,5e,67,4d,56,57,24,51,f8,be,a6,58,86,\ d7,58,72,2a,d6,3b,00,8b,56,41,c9,10,b7,20,79,40,c2,28,f2,49,64,74,29,51,56,\ 5c,fc,da,bf,4b,94,16,4a,64,46,4a,ac,de,14,5a,03,b7,95,e4,b8,83,0a,dd,ff,0c,\ c2,96,0b,3b,11,3d,6b,18,6d,bb,59,ca,ea,ae,45,06,c6,f6,51,9e,fa,02,9c,a6,28,\ bc,2d,b9,30,eb,74,56,de,e7,5a,65,8c,33,de,dc,f3,53,f6,12,34,1e,00,d1,8a,f1,\ dc,ff,07,a0,06,eb,b6,9f,9b,a2,f5,9b,6b,2e,05,96,53,f6,f1,cc,46,ef,53,08,11,\ a0,72,5e,74,62,6d,1c,9e,65,96,c4,1a,f4,ae,cc,19,8d,9f,c3,e8,c0,b3,fb,8d,cc,\ 8d,18,f6,b4,ff,61,9d,67,83,8c,7f,37,27,14,a6,c2,ef,f3,96,f3,a1,03,57,b7,c8,\ ae,93,ef,aa,96,05,6e,48,fb,a9,c1,f9,1b,14,00,00,00,8a,f8,fe,17,74,95,bf,ed,\ 41,d9,9c,f2,80,66,c1,09,b5,36,ae,65 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SCLogon] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList] "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000

OK , your fine You can reboot now. I don't know why that got corrupted, it may have been malware trying to change it. <_< Hope all is running well now

well things seem to running alot better now. Thanks for the help keep up the good work!

Your very welcome

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php